.github/workflows/ci.yml

@@ -44,10 +44,10 @@ jobs:
           - distro: rockylinux9
             playbook: converge.yml
             experimental: false
-          - distro: ubuntu2404
+          - distro: ubuntu2004
             playbook: converge.yml
             experimental: false
-          - distro: debian12
+          - distro: debian10
             playbook: converge.yml
             experimental: false
 

README.md

@@ -1,6 +1,6 @@
 # Ansible Role: Certbot (for Let's Encrypt)
 
-[![CI](https://github.com/geerlingguy/ansible-role-certbot/actions/workflows/ci.yml/badge.svg)](https://github.com/geerlingguy/ansible-role-certbot/actions/workflows/ci.yml)
+[![CI](https://github.com/geerlingguy/ansible-role-certbot/workflows/CI/badge.svg?event=push)](https://github.com/geerlingguy/ansible-role-certbot/actions?query=workflow%3ACI)
 
 Installs and configures Certbot (for Let's Encrypt).
 

defaults/main.yml

@@ -13,16 +13,13 @@ certbot_hsts: false
 # Parameters used when creating new Certbot certs.
 certbot_create_if_missing: false
 certbot_create_method: standalone
-certbot_create_extra_args: ""
 certbot_admin_email: email@example.com
-certbot_expand: false
 
 # Default webroot, overwritten by individual per-cert webroot directories
 certbot_webroot: /var/www/letsencrypt
 
 certbot_certs: []
-# - name: example.com
+# - email: janedoe@example.com
-#   email: janedoe@example.com
 #   webroot: "/var/www/html/"
 #   domains:
 #     - example1.com
@@ -30,28 +27,24 @@ certbot_certs: []
 # - domains:
 #     - example3.com
 
+certbot_create_extra_args: ""
+
 certbot_create_command: >-
   {{ certbot_script }} certonly --{{ certbot_create_method  }}
   {{ '--hsts' if certbot_hsts else '' }}
   {{ '--test-cert' if certbot_testmode else '' }}
   --noninteractive --agree-tos
   --email {{ cert_item.email | default(certbot_admin_email) }}
-  {{ '--expand' if certbot_expand else '' }}
   {{ '--webroot-path ' if certbot_create_method == 'webroot'  else '' }}
   {{ cert_item.webroot | default(certbot_webroot) if certbot_create_method == 'webroot' else '' }}
   {{ certbot_create_extra_args }}
-  --cert-name {{ cert_item_name }}
   -d {{ cert_item.domains | join(',') }}
-  {{ '--expand' if certbot_expand else '' }}
   {{ '--pre-hook /etc/letsencrypt/renewal-hooks/pre/stop_services'
     if certbot_create_standalone_stop_services and certbot_create_method == 'standalone'
   else '' }}
   {{ '--post-hook /etc/letsencrypt/renewal-hooks/post/start_services'
     if certbot_create_standalone_stop_services and certbot_create_method == 'standalone'
   else '' }}
-  {{ "--deploy-hook '" ~ cert_item.deploy_hook ~ "'"
-    if 'deploy_hook' in cert_item
-  else '' }}
 
 certbot_create_standalone_stop_services:
   - nginx

molecule/default/converge.yml

@@ -1,7 +1,7 @@
 ---
 - name: Converge
   hosts: all
-  # become: true
+  become: true
 
   vars:
     certbot_auto_renew_user: root

molecule/default/playbook-snap-install.yml

@@ -1,7 +1,7 @@
 ---
 - name: Converge
   hosts: all
-  #become: true
+  become: true
 
   vars:
     certbot_install_method: 'snap'

molecule/default/playbook-source-install.yml

@@ -1,7 +1,7 @@
 ---
 - name: Converge
   hosts: all
-  #become: true
+  become: true
 
   vars:
     certbot_install_method: 'source'

molecule/default/playbook-standalone-nginx-aws.yml

@@ -91,8 +91,7 @@
     certbot_create_if_missing: true
     certbot_create_standalone_stop_services: []
     certbot_certs:
-      - name: certbot-test.servercheck.in
+      - domains:
-        domains:
           - certbot-test.servercheck.in
     nginx_vhosts:
       - listen: "443 ssl http2"

tasks/create-cert-standalone.yml

@@ -1,11 +1,7 @@
 ---
-- name: Determine certificate name
-  set_fact:
-    cert_item_name: "{{ cert_item.name | default(cert_item.domains | first | replace('*.', '')) }}"
-
 - name: Check if certificate already exists.
   stat:
-    path: /etc/letsencrypt/live/{{ cert_item_name }}/cert.pem
+    path: /etc/letsencrypt/live/{{ cert_item.domains | first | replace('*.', '') }}/cert.pem
   register: letsencrypt_cert
 
 - name: Ensure pre and post hook folders exist.
@@ -41,23 +37,6 @@
     - certbot_create_standalone_stop_services is defined
     - certbot_create_standalone_stop_services
 
-- name: Check if domains have changed
-  block:
-    - name: Register certificate domains
-      shell: "{{ certbot_script }} certificates --cert-name {{ cert_item_name }} | grep Domains | cut -d':' -f2"
-      changed_when: false
-      register: letsencrypt_cert_domains_dirty
-
-    - name: Cleanup domain list
-      set_fact:
-        letsencrypt_cert_domains: "{{ letsencrypt_cert_domains_dirty.stdout | trim | split(' ') | map('trim') | select('!=', '') | list | sort }}"
-
-    - name: Determine if domains have changed
-      set_fact:
-        letsencrypt_cert_domains_changed: "{{ letsencrypt_cert_domains != (cert_item.domains | map('trim') | select('!=', '') | list | sort) }}"
-
-  when: letsencrypt_cert.stat.exists
-
 - name: Generate new certificate if one doesn't exist.
   command: "{{ certbot_create_command }}"
-  when: not letsencrypt_cert.stat.exists or letsencrypt_cert_domains_changed | default(false)
+  when: not letsencrypt_cert.stat.exists

tasks/create-cert-webroot.yml

@@ -1,11 +1,7 @@
 ---
-- name: Determine certificate name
-  set_fact:
-    cert_item_name: "{{ cert_item.name | default(cert_item.domains | first | replace('*.', '')) }}"
-
 - name: Check if certificate already exists.
   stat:
-    path: /etc/letsencrypt/live/{{ cert_item_name }}/cert.pem
+    path: /etc/letsencrypt/live/{{ cert_item.domains | first }}/cert.pem
   register: letsencrypt_cert
 
 - name: Create webroot directory if it doesn't exist yet
@@ -13,23 +9,6 @@
     path: "{{ cert_item.webroot | default(certbot_webroot) }}"
     state: directory
 
-- name: Check if domains have changed
-  block:
-    - name: Register certificate domains
-      shell: "{{ certbot_script }} certificates --cert-name {{ cert_item_name }} | grep Domains | cut -d':' -f2"
-      changed_when: false
-      register: letsencrypt_cert_domains_dirty
-
-    - name: Cleanup domain list
-      set_fact:
-        letsencrypt_cert_domains: "{{ letsencrypt_cert_domains_dirty.stdout | trim | split(' ') | map('trim') | select('!=', '') | list | sort }}"
-
-    - name: Determine if domains have changed
-      set_fact:
-        letsencrypt_cert_domains_changed: "{{ letsencrypt_cert_domains != (cert_item.domains | map('trim') | select('!=', '') | list | sort) }}"
-
-  when: letsencrypt_cert.stat.exists
-
 - name: Generate new certificate if one doesn't exist.
   command: "{{ certbot_create_command }}"
-  when: not letsencrypt_cert.stat.exists or letsencrypt_cert_domains_changed | default(false)
+  when: not letsencrypt_cert.stat.exists